AiTools
Decode JWTs safely without sending them to a server
How to inspect JWT headers and payloads in your browser, plus related encoding tools — and why you should never paste production tokens into untrusted sites.
JSON Web Tokens show up in Authorization headers, cookies, and mobile apps. Debugging “why is this 401 happening?” often means reading the payload — claims, expiry, audience — without verifying the signature in a random online decoder.
Inspect locally
JWT Decoder splits a token and shows the header and payload as readable JSON. It does not verify signatures. That is intentional for a client-side inspector: verification needs the correct key or JWKS endpoint, which belongs in your app or API gateway.
What to look for
expandnbffor clock issuesaud/issmismatches between environments- Custom claims your API expects
If the token is malformed, fix encoding first. Base64 Encode / Decode and URL Encode / Decode help when tokens get mangled in logs or query strings.
What not to do
Do not paste live production tokens into websites you do not control. Even “decode only” services may log request bodies. Prefer AiTools or a local script so the token never leaves your machine.
After debugging
Revoke or rotate tokens if they were exposed in screenshots, tickets, or chat. Clear the decoder field when you are finished.